China's National Vulnerability Database Alleges Backdoor in Anthropic's Claude Code, Warns of Data Exfiltration
China Issues 'Backdoor' Security Alert for Anthropic's Claude Code AI Tool
Full Report
Executive Summary
On July 8, 2026, China's National Vulnerability Database (NVDB) issued a high-priority security alert concerning Anthropic's AI coding assistant, Claude Code. The Chinese government agency alleges that specific versions of the tool contain a 'backdoor' functionality. This alleged backdoor is described as a built-in monitoring mechanism capable of exfiltrating sensitive user information, such as location and identity data, to remote servers without user consent. The NVDB has advised all Chinese organizations to cease using the affected versions (2.1.91 through 2.1.196) and has recommended enhanced network security controls. This move signals escalating geopolitical tensions in the technology sector, particularly around AI tools and data sovereignty.
Regulatory Details
- Issuing Body: China National Vulnerability Database (NVDB), operated by China's Ministry of Industry and Information Technology.
- Subject: Anthropic Claude Code, an AI-powered coding assistant.
- Allegation: The tool contains a 'backdoor' or undisclosed monitoring mechanism.
- Affected Versions:
2.1.91through2.1.196. - Claimed Functionality: The mechanism allegedly transmits sensitive user data, including geographic location and identity-related identifiers, to remote servers without user consent or knowledge.
- Official Recommendation: Chinese organizations and users are advised to immediately review their systems and take one of two actions: uninstall the affected versions or upgrade to a secure version where the alleged backdoor is not present. Additionally, the agency recommended tightening network controls and monitoring to prevent data exfiltration.
Affected Organizations
The alert directly impacts:
- Chinese Companies and Developers: Any organization or individual in China using the specified versions of Claude Code is now under pressure to stop.
- Anthropic: The company faces serious allegations that could damage its reputation globally and effectively bar it from the Chinese market. The lack of an immediate comment from Anthropic leaves the claims unrefuted for now.
- Multinational Companies: Companies operating in China that use Claude Code will need to navigate this directive. The alert follows a recent report that Chinese tech giant Alibaba had already banned employee use of the tool.
Compliance Requirements
The NVDB's alert, while not a formal law, functions as a strong directive for Chinese entities. The implied compliance requirements are:
- Software Inventory: Organizations must identify all instances of Claude Code within their environments and determine their version numbers.
- Remediation: Uninstall or upgrade all identified instances of the affected versions.
- Enhanced Network Security: Implement stricter egress filtering on developer workstations and core business networks to block unauthorized connections to external servers.
- Traffic Monitoring: Increase monitoring of network traffic to detect and investigate any suspicious data flows, particularly from development tools.
Impact Assessment
- Business Impact: For Anthropic, this could mean a complete loss of the Chinese market. For companies in China, it could disrupt development workflows that have come to rely on Claude Code. It may also force a migration to domestic AI coding tools.
- Geopolitical Impact: This action is part of a broader 'tech war' trend, where countries are scrutinizing foreign technology for potential security risks. It raises questions about data privacy and state-sponsored surveillance, regardless of the allegation's validity.
- Operational Impact: Security and IT teams in affected organizations must now undertake an unplanned software audit and remediation project, diverting resources from other tasks. They must also implement and manage more stringent network controls, which could impact productivity.
Enforcement & Penalties
While the alert itself does not specify penalties, non-compliance with directives from a ministry-level body in China can lead to serious consequences for businesses. This can include government audits, loss of business licenses, or being barred from government contracts. The reputational risk for a company seen as ignoring a national security warning is also significant.
Compliance Guidance
Organizations in China should take the following steps:
- Immediate Audit: Use endpoint management tools or scripts to scan all developer machines for the presence of Claude Code and its version number.
- Isolate and Remove: Block network access for any machine running an affected version. Proceed with uninstallation as recommended.
- Policy Update: Update corporate IT policy to explicitly ban the use of the affected versions and provide guidance on approved AI coding tools.
- Implement Egress Filtering: Configure firewalls and proxies to deny outbound connections from developer tools to any non-essential, non-approved endpoints. This is a key principle of a zero-trust architecture.
Timeline of Events
MITRE ATT&CK Mitigations
Filter Network Traffic
Implement strict egress filtering to block unauthorized outbound connections from development tools, as recommended by the NVDB.
Mapped D3FEND Techniques:
Limit Software Installation
Enforce policies that restrict the installation and use of unauthorized or banned software versions.
D3FEND Defensive Countermeasures
In response to the Chinese NVDB alert on Claude Code, organizations must implement robust Outbound Traffic Filtering as a primary defense. This involves configuring perimeter firewalls and web proxies to enforce a default-deny policy for egress traffic, especially from developer workstations and build servers. An explicit allowlist should be created, permitting connections only to known, vetted endpoints required for business operations (e.g., corporate cloud services, official package repositories). All other outbound connections should be blocked and logged. This strategy directly counters the alleged 'backdoor' by preventing the Claude Code application from communicating with any unauthorized remote server, thus blocking the potential exfiltration of sensitive data like location or identity information.
To comply with the NVDB directive, organizations should use Executable Denylisting (also known as application blocklisting) to prevent the specified versions of Claude Code from running. Using an endpoint security solution like an EDR or a tool like Microsoft AppLocker, administrators can create rules that block the execution of processes based on their file hash, publisher certificate, or file path. For this incident, rules should be created to block the known hashes of Claude Code versions 2.1.91 through 2.1.196. This provides a strong enforcement mechanism, ensuring that even if a user attempts to install or run the banned software, the operating system will prevent it from executing. This is a more reliable control than simply asking users to uninstall the software.
Timeline of Events
China's National Vulnerability Database (NVDB) issues a security alert regarding Anthropic's Claude Code.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.